Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-46281 Details

Description

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://cert-portal.siemens.com/productcert/html/ssa-999588.html CVE
https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf CVEPatchVendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-999588.html [email protected]
https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf [email protected]PatchVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-942Permissive Cross-domain Policy with Untrusted Domains[email protected]

Affected Products

ProductVersions
siemens opcenter quality
All versions

CPE

  • cpe:2.3:a:siemens:opcenter_quality:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
siemens simatic pcs neo
< 4.1

CPE

  • cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
siemens sinumerik integrate runmyhmi /automotive
All versions

CPE

  • cpe:2.3:a:siemens:sinumerik_integrate_runmyhmi_/automotive:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
siemens totally integrated automation portal
>= 14.0, < 15
>= 15, < 16
>= 16, < 17
>= 17, < 18
18

CPE

  • cpe:2.3:a:siemens:totally_integrated_automation_portal:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:totally_integrated_automation_portal:-:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:totally_integrated_automation_portal:18:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:totally_integrated_automation_portal:18:update_1:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

12 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-46281
NVD Published Date:
Dec 12, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-46281 Details - Not Deferred